Relaxed composer version requirements so that stable releases can be created.

Note that once sapphire, cms, and framework actually provide a stable version, '@stable' should put onto the end of the relevant require clauses.
Support for composer-created themes dir structure

Due to git limitations, we can't check out the blackcandy
"parent" theme into themes/blackcandy/ directly, since that
would require sharing paths with git repositories of other themes.
Added @stable markers to composer.json
Added composer.lock for 2.4.9
Removed composer.lock
Added phing support
Removed @stable tags from release branch

Same as 3.0.x-dev, they're only relevant for tags,
not for branches.
API Filter composer files in IIS and Apache rules (fixes #8011)

They can expose version information, so shouldn't be accessible
through the web. The better solution of course is to move
to a public/ subfolder application structure.
Merge remote-tracking branch 'origin/2.4' into post-2.4

Conflicts:
	build.xml
	install.php